Hundreds of holiday cakes were purloined through weakness in internal website.

Share this story

China's Mid-Autumn Festival started today, as much of the world now knows due to a runaway inflatable moon incident reported yesterday (as seen below). Celebrated on the 15th day of the eighth month in the Han calendar—corresponding to the full moon closest to the Autumnal Equinox—the holiday is commemorated in Chinese culture through the exchange and sharing of moon cakes.

That escaped moon, blown loose by typhoon winds in Fuzhou.

The cakes are round pastries filled with lotus seed paste or red bean paste and occasionally the salted yolk of a duck egg surrounded by a thin crust. They are traditionally given as presents by businesses and are in huge demand in much of China and in Chinese communities around the world leading up to the festival. And that's likely what drove four employees of the Chinese e-commerce site Alibaba to exploit a weakness in an internal company website offering discounted mooncakes to company staff.

Alibaba offered its employees one free mooncake each—complete with a plush Alibaba mascot hidden inside, rather than the traditional duck yolk. Additional cakes were sold at cost to employees for friends and family through an internal e-commerce page. But as China Daily reports, the four employees—software engineers at the company—were able to surreptitiously insert additional software into the website, directing extra mooncakes to themselves. Alibaba's internal security team detected the hack and found that the four were "cheating using technology" to amass 124 boxes of the cakes (with four cakes per box). All four employees were dismissed.

One alleged cake hacker confessed on the question-and-answer site Zhihu (a Chinese equivalent of Quora). He claimed he had been unable to buy a cake through the internal website and created his own "plug-in" to hack for cakes after he discovered others were doing the same. The individual claimed that while he shifted his attention to other tasks, the hack he had created ordered 16 boxes of free cakes. Within two hours, he claimed, he was caught by corporate security and was asked to leave.

"This is the fastest dismissal I have ever experienced," he wrote. "It may also rank high on the list for goofballs."

Share this story

Sean Gallagher
Sean is Ars Technica's IT and National Security Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland. Emailsean.gallagher@arstechnica.com//Twitter@thepacketrat

How little were they being paid that they felt stealing mooncakes was worth it?

People who make good money will still cheat and steal.

But they usually cheat and steal good money, not some cakes XD

Like most things, they probably figured that - if anyone cared - it'd be no worse than a slap on the wrist and a stern finger-wagging not to do anything like that again. This was probably the last thing they expected....especially during the holiday.

How little were they being paid that they felt stealing mooncakes was worth it?

It doesn't necessarily correlate with pay. Giving mooncakes to friends and family is an important tradition and your culturally supposed to spend a lot on them. I've spent ~$60USD for a box of 4 for my employees in the past when there are boxes that go for $5 and are essentially the same thing.

I could see "rarity" correlating with this as well, e.g. "you can't buy these anywhere" but you don't have to tell you friends you got them free of charge...

How little were they being paid that they felt stealing mooncakes was worth it?

Mooncake box can cost up to 200 yuan ($30 USD although in the US I've seen them over $50USD). The average income is roughly 30000 yuan ($4500). So stealing 24 box at 200 = 4800 yuan - or roughly 15% of what they earn in a year (with the US median income at roughly $50,000 USD a year, that would be like someone stealing $8000 USD worth of merchandise through what they thought was a victimless and hidden crime a la Office Space).

How little were they being paid that they felt stealing mooncakes was worth it?

Mooncake box can cost up to 200 yuan ($30 USD although in the US I've seen them over $50USD). The average income is roughly 30000 yuan ($4500). So stealing 24 box at 200 = 4800 yuan - or roughly 15% of what they earn in a year (with the US median income at roughly $50,000 USD a year, that would be like someone stealing $8000 USD worth of merchandise through what they thought was a victimless and hidden crime a la Office Space).